I installed 6.2 in a lab environment and I'm getting some weird results when I do searches.
I have 1 indexer and 1 search head. I added the search peer using this. I deployed a few apps to a couple of hosts using a deployment server. I can see the indexes populating.
But, when I go to the search app on the search head or the indexer, the "what to search" text in the middle of the page states "waiting for data...." (?)
If I do a search host=*
, I get nothing. The only time I will see anything is if I do a search by index index=*
What did I forget to do?
Even though I was logged in as admin, the index that is searched by default for the admin user is only "main". Once I made the changes, everything worked.
Even though I was logged in as admin, the index that is searched by default for the admin user is only "main". Once I made the changes, everything worked.
I consider it good practice to always write searches with the index(es) specified, then they work without relying on the indexes searched by default.